What does Windows error code 13899 (ERROR_IPSEC_IKE_INNER_IP_ASSIGNMENT_FAILURE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: An IKEv2 responder could not assign a virtual tunnel address to the initiator.

Previous	Next
ERROR_IPSEC_IKE_KILL_DUMMY_NAP_TUNNEL	ERROR_IPSEC_IKE_REQUIRE_CP_PAYLOAD_MISSING

ERROR_IPSEC_IKE_INNER_IP_ASSIGNMENT_FAILURE

ERROR_IPSEC_IKE_INNER_IP_ASSIGNMENT_FAILURE is reported when tunnel configuration reaches the point where an IKEv2 responder must assign an internal, or virtual, IP address to the initiator and cannot do so. This address belongs on the protected side of the VPN; it is not the public address or UDP 500/4500 endpoint used for the outer IKE exchange.

IKEv2 carries this configuration through a Configuration Payload (CP). A client can request an internal IPv4 or IPv6 address, and the responder can reply with an address from its configured pool. The status therefore points to address allocation or policy for the tunnel, not to a cipher-suite mismatch or a failure to reach the peer.

Distinguish the failure stage

ERROR_IPSEC_IKE_REQUIRE_CP_PAYLOAD_MISSING means the required Configuration Payload was absent; this status means a CP was processed but no usable assignment resulted.
An assigned address with unusable traffic is a later problem: inspect traffic selectors, routes, and the CHILD SA rather than assuming the address pool is empty.
A failure before IKE authentication or before an IKE SA exists belongs to a different negotiation stage.

What to inspect

The IKE_AUTH exchange on both peers: confirm the Configuration Payload requests the intended address family and that the responder sends a compatible reply.
The responder's virtual-address pool, leases, cleanup of stale allocations, and whether the pool has an address suitable for the requesting client.
Whether the assigned address family and the protected traffic selectors are compatible with the tunnel policy.
On Windows, whether a main-mode SA exists and whether a quick-mode SA follows it; this narrows the failure to negotiation versus protected traffic setup.

Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSA

References

Looking for a different code? Search another status or error code.